1. DATA CONTROLLER

The Data Controller and owner of the domain https://unwrittenspain.com/ (hereinafter, the Website) is CMP 21 SERVICIOS S.L, with registered address at Calle Fray Bernardino Sahagún, 9, 28036 Madrid (Spain), Tax ID: B84546951

Contact details:

2. PURPOSE AND LEGAL BASIS FOR PROCESSING

The data you provide may be processed for the following purposes:

  1. To manage orders, requests, or any type of query submitted via the contact forms available on the website. Legal basis: user consent.
  2. To send commercial communications by email, SMS, or other electronic or physical means, regarding our products or services or those of our partners. Third parties will not access your data. Legal basis: user consent.
  3. To respond to queries related to the exercise of your rights as explained below. Legal basis: compliance with legal obligations.
  4. If you submit your CV, you authorize us to review the data and documents. These will be stored for a maximum of six months unless otherwise requested. Legal basis: user consent.

5. WHISTLEBLOWING CHANNEL
Purpose: If you use our whistleblowing channel and identify yourself, your data will be processed to manage your report within the Internal Reporting System, in compliance with Law 2/2023 on Whistleblower Protection.
Legal basis: your consent when submitting the report voluntarily, and legal obligation.
Additional information: You may request detailed information about our data processing records by emailing info@unwrittenspain.com.

3. DATA RETENTION PERIODS

As a general rule, your data will be retained while there is a contractual relationship or you do not request its deletion, opposition, or restriction. Once this occurs, the data will be blocked and retained only for legal purposes, such as defense in legal proceedings or obligations derived from processing. They will only be accessible to Courts, the Public Prosecutor’s Office, and Data Protection Authorities.

Once the retention period ends, data will be securely destroyed to ensure pseudonymization or complete erasure.

Additionally:

  • Four years for tax purposes (Articles 66+ of the Spanish General Tax Law).
  • Six years for accounting books and invoices (Article 30 of the Commercial Code).

Retention of whistleblowing data:
Data will be retained only for the time necessary to investigate the facts. If the case results in measures against the reported person, a longer retention may apply. In general, data will be deleted after three months unless extended by another three months or if judicial or official investigations arise.

4. YOUR DATA PROTECTION RIGHTS

You are entitled to the following rights:

  • Right of access: Know what personal data is being processed and for what purposes.
  • Right of rectification: Request correction of inaccurate or outdated data.
  • Right of portability: Request a copy of your data in an interoperable format.
  • Right to restrict processing: Request limited processing under certain conditions.
  • Right of erasure: Request deletion of your data when it is no longer necessary.
  • Right to object: Oppose the sending of communications under specified conditions.
  • Right to withdraw consent: At any time.

To exercise your rights, send a clear and signed request by email or post, including sufficient identification. If we have reasonable doubts, we may request additional information to verify your identity.

By Email: Send your request to info@unwrittenspain.com with the subject “Data Protection”. It must be sent from the same email address provided in the forms. Otherwise, we may not validate your identity and cannot provide access.

By Post: Send your request to Calle Fray Bernardino Sahagún, 9, 28036 Madrid (Spain).

If you do not receive a timely or satisfactory response, you may file a complaint with the Spanish Data Protection Authority (www.aepd.es), where you can also find templates for exercising your rights.

5. DATA DISCLOSURE

Your personal data will not be shared with third parties unless required by law. Any exception will require your prior, explicit, and informed consent.

In compliance with legal obligations, we may disclose your data to public administrations and courts, if required.

If you contact us through social media, you also provide your data to the respective social platform. We recommend reviewing their privacy policies for more information.

WHISTLEBLOWING CHANNEL RECIPIENTS

Access to the data provided via the whistleblowing channel will be limited to:

  • The person responsible for the channel and those managing it.
  • HR or the designated body, if disciplinary measures are needed.
  • Legal advisors, if legal action is required.
  • Authorized data processors, if appointed.
  • The Data Protection Officer, if applicable.
  • Courts and the Public Prosecutor’s Office if criminal activity is suspected.

We also work with service providers under data processing agreements that meet legal requirements.

6. SECURITY MEASURES

In accordance with GDPR (Regulation EU 2016/679) and the Spanish Organic Law 3/2018, we comply with all data protection principles and ensure that data is processed lawfully, fairly, and transparently.

We have implemented technical and organizational measures to safeguard your rights. However, you should be aware that Internet security is not foolproof.

This website uses HTTPS (secure connection), which encrypts all communication between the server and the user.

7. MINORS

Minors under 14 years old cannot use the services on this Website without prior authorization from their parents or legal guardians. They are solely responsible for actions taken by minors under their care, including filling out forms and checking consent boxes.

We are not responsible for the accuracy of data provided by minors.

Data processing based on consent is only valid if the minor is over 14 years old or if consent is given by the person holding parental authority or guardianship.

8. DURATION AND MODIFICATIONS TO THE PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time by publishing changes on the Website. We may also modify, remove, or add content or services without prior notice.

Therefore, the applicable policy is the one in force at the time of access. We recommend reviewing it regularly.

We may also suspend or terminate access to the content at any time without prior notice and without the right to claim compensation.